fa34ab87399d4ce1c9e0433212db1ce8c3bc7f315be2a643ff16ef0ea963ac76

Analysis

Target
emotet_exe_e4_fa34ab87399d4ce1c9e0433212db1ce8c3bc7f315be2a643ff16ef0ea963ac76_2022-02-03__191053.dll
Size 977KB
Sample220203-xv9bfadccj
SHA256 fa34ab87399d4ce1c9e0433212db1ce8c3bc7f315be2a643ff16ef0ea963ac76
MD5 9c9613227e242b8b91abf0bfaec4ae11
SHA1 c50b8a58a25568c72b20f61b323ed6ff7c6f86bd
SHA512 7664ab57d1df4bf6b62d8f4f40e306b389b50abb0f4772041c4f81f4b906f345faebf0a703fee59498e51b8806dbe50ece2ba4328ee5764e9b8607f900a937c2
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4272 wrote to memory of 3908	4272	regsvr32.exe	81
PID 4272 wrote to memory of 3908	4272	regsvr32.exe	81
PID 4272 wrote to memory of 3908	4272	regsvr32.exe	81

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_fa34ab87399d4ce1c9e0433212db1ce8c3bc7f315be2a643ff16ef0ea963ac76_2022-02-03__191053.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_fa34ab87399d4ce1c9e0433212db1ce8c3bc7f315be2a643ff16ef0ea963ac76_2022-02-03__191053.dll
  2⤵
  PID:3908